VMware 5V0-91.20 VMware Carbon Black Portfolio Skills Exam Exam Practice Test Questions

• Question 1

  Review the following EDR query:parent_name:outlook.exe AND -alliance_score_srstrust:* AND -digsig_result: 'Signed'Which process would show in the query results?

  • Processes invoked by outlook.exe that have an SRS Trust value and that are digitally signed.
  • Processes invoking outlook.exe that do not have an SRS Trust value and that are not digitally signed.
  • Processes invoked by outlook.exe that do not have an SRS Trust value and that are not digitally signed.
  • Processes invoking outlook.exe that have an SRS Trust value and that are not digitally signed.

  Show Answer Answer: 4 Next

• Question 2

  An administrator has updated a Threat Intelligence Report by turning it into a watchlist and needs to disable (Ignore) the old Threat Intelligence Report.Where in the UI is this action not possible to perform?

  • Search Threat Reports Page
  • Threat Intelligence Feeds Page
  • Threat Report Page
  • Triage Alerts Page

  Show Answer Answer: 2 Next

• Question 3

  An Endpoint Standard analyst runs the query in the graphic below:Which three statements are true from the results shown? (Choose three.)

  • The process is a PowerShell process running a script with a .ps1 extension.
  • The process has a threat score greater than 4.
  • The process made a network connection to another system.
  • The process had a NOT_LISTED reputation at the time the event occurred.
  • The process was run under the NT_AUTHORITY\SYSTEM user context.
  • The process was able to inject code into another process.

  Show Answer Answer: 1, 4, 6 Next

• Question 4

  An Enterprise EDR administrator wants to use Watchlists curated by VMware Carbon Black and other threat intelligence specialists.How should the administrator add these curated Watchlists from the Watchlists page?

  • Click Add Watchlists, and input the URL(s) for the desired Watchlists.
  • Click Take Action, select Edit, and select the desired Watchlists.
  • Click Take Action, and select Subscribe for the desired Watchlists.
  • Click Add Watchlists, on the Subscribe tab select the desired Watchlists, and click Subscribe.

  Show Answer Answer: 1 Next

• Question 5

  Which statement correctly defines the results of ignoring a feed report?

  • Ignoring a feed report will ignore future instances of that report.
  • Ignoring a feed report will ignore all indicators in other threat reports.
  • Ignoring a feed report will also ignore the threat intelligence feed.
  • Ignoring a feed report will remove all instances of the report.

  Show Answer Answer: 3 Next